Expressway charging abnormity monitoring and identification system

Abstract

The invention discloses a highway toll collection abnormity monitoring and identification system, relates to the technical field of data analysis, and solves the problems of data synchronization delay, packet loss and abnormal operation identification errors in the prior art by constructing the highway toll collection abnormity monitoring and identification system. The system comprises a data acquisition module, a feature extraction module, a real-time evaluation module, a real-time division module, an identification processing module and an early warning module, can comprehensively acquire, analyze and evaluate special operation monitoring data, and evaluates the real-time performance of data synchronization by extracting transmission delay and data loss features and utilizing a machine learning model, so that the real-time performance of the data synchronization is improved. Data are divided into high, medium and low real-time levels, targeted processing measures are taken, the high-real-time data preferentially analyzes potential violation operations, the low-real-time data carries out equipment and network troubleshooting, and the medium-real-time data triggers early warning by evaluating the abnormal degree to remind operation and maintenance personnel to process in time. Therefore, the accuracy, the safety and the stability of the charging system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis, and in particular to a highway toll anomaly monitoring and identification system. Background Art

[0002] The highway toll anomaly monitoring and identification system is a core component of highway toll management, which aims to ensure the accuracy and fairness of toll collection operations and prevent violations. The system can identify and record abnormal operations such as manual lifting of the bar, cancellation of coil operation, re-printing of invoices, and modification of toll data by real-time monitoring of special operations during the toll collection process. Records of these operations are automatically uploaded to the station-level system for further query and audit by the system. The station-level program can review special operations and fill in corresponding conclusions to ensure that the toll collector's operations are within the legal scope, thereby effectively avoiding violations such as unauthorized release of vehicles. This system not only improves the transparency of the toll collection process, but also strengthens the timely intervention of abnormal situations, ensuring the fairness and standardization of highway toll collection.

[0003] The prior art has the following deficiencies: Highway toll collection systems usually rely on multiple sites and subsystems for data transmission and synchronization. Delays or failures in any link may lead to incorrect judgments of abnormal operations. If the monitoring data of special operations is not uploaded or synchronized to the central system in a timely manner, the system may fail to identify illegal operations in a timely manner. In addition, there may be problems such as packet loss, delays, and error checks during data synchronization, resulting in the monitoring system being unable to update in a timely manner, generating error reports or missing key abnormal data. Summary of the invention

[0004] The purpose of the present invention is to provide a highway toll anomaly monitoring and identification system to solve the shortcomings of the background technology.

[0005] In order to achieve the above-mentioned object, the present invention provides the following technical solutions: a highway toll anomaly monitoring and identification system, including a data acquisition module, a feature extraction module, a real-time evaluation module, a real-time division module, an identification processing module and an early warning module; Data collection module: Generates a corresponding timestamp for each special operation record in the site system, and generates a corresponding timestamp for each received special operation data in the central system, and collects a variety of special operation monitoring data from different sites within several time periods; Feature extraction module: pre-processes the collected special operation monitoring data, and extracts features from the pre-processed special operation monitoring data, respectively extracting transmission delay features and data loss features of the special operation monitoring data; Real-time evaluation module: Based on the transmission delay characteristics and data loss characteristics of the extracted special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of the special operation monitoring data to the central system, and the real-time synchronization of the special operation monitoring data to the central system is determined based on the output results of the machine learning model; Real-time classification module: According to the evaluation results, the special operation monitoring data is divided into high real-time data, medium real-time data and low real-time data, and processed accordingly; Identification and processing module: Prioritize real-time analysis of high-real-time data to quickly identify and handle potential illegal operations; prioritize checking sites, equipment, and operations involved in low-real-time data to remind the operation and maintenance team to perform maintenance; Early warning module: For real-time data, the special operation monitoring data within a fixed time period is synchronized to the central system to evaluate the degree of real-time anomaly. If the degree of anomaly is high, an abnormal alarm is issued to relevant operation and maintenance personnel through the early warning system.

[0006] Preferably, in the feature extraction module, the transmission delay feature of the special operation monitoring data sent from the site system to the central system is analyzed to generate a data transmission delay fluctuation index, and the method for obtaining the data transmission delay fluctuation index is: Delaying the time series Convert to a vector sequence and reconstruct the phase space by delayed embedding: ; Where: Y(t) is a vector representing the state of the system, m is the embedding dimension, which is usually selected by the time delay method, and τ is the delay time, which is selected as the time interval of the data sequence; The phase space trajectory Y(t) reconstructed by time series embedding is analyzed to analyze the distance between adjacent vectors, and the Euclidean distance between adjacent vectors Y(t) and Y(t+1) is calculated. , the expression is: ;in, It is the i-th component in the phase space. Starting from the initial time t=0, a pair of trajectories is selected, their distance is calculated, the distance of the pair of trajectories is tracked through time advancement, and the growth of the distance over time is calculated, that is, the data transmission delay fluctuation index is calculated. The calculation formula is: ; Where d(t) is the distance at time t, d(0) is the distance at the initial time, t is time, and AD is the data transmission delay fluctuation index.

[0007] Preferably, in the feature extraction module, after analyzing the data loss characteristics that fail to reach the central system during the special data transmission process, a packet loss rate anomaly index is generated. The method for obtaining the packet loss rate anomaly index is: Preprocess the acquired packet loss rate time series data, select the wavelet basis function, and the basic formula of wavelet transform is: ;in, is the result of wavelet transform, which represents the transform coefficient of signal f(s) at scale a and position b. is a wavelet basis function, which decomposes the time series data of the packet loss rate into multiple frequency bands. According to the wavelet transform results, the coefficients of each frequency component are obtained. The high-frequency component extracted from the wavelet transform is set as H(s), where s is the timestamp, and H(s) represents the high-frequency fluctuation part of the packet loss rate at time s. The standard deviation of the high-frequency component is calculated, and the expression is: ;in: is the standard deviation of the high frequency components, is the mean of the high-frequency component, n is the time length of the data, and the volatility is calculated : ; By combining the standard deviation and volatility characteristics, the packet loss rate anomaly index is calculated: ;in, is the packet loss rate anomaly index.

[0008] Preferably, in the real-time evaluation module, a machine learning model for predicting the real-time synchronization of the special operation monitoring data to the central system is trained based on the transmission delay characteristics and data loss characteristics of the extracted special operation monitoring data, and the real-time synchronization of the special operation monitoring data to the central system is determined based on the output result of the machine learning model, specifically: The data transmission delay fluctuation index and the packet loss rate anomaly index are converted into comprehensive feature vectors, and the comprehensive feature vectors are used as the input of the machine learning model. The machine learning model uses each group of comprehensive feature vectors to predict the real-time value label of the special operation monitoring data synchronized to the central system as the prediction target, and takes minimizing the sum of prediction errors of all special operation monitoring data synchronized to the central system as the training target. The machine learning model is trained until the sum of prediction errors converges and the model training is stopped. The real-time value of the special operation monitoring data synchronized to the central system is determined according to the model output results, wherein the machine learning model is a polynomial regression model.

[0009] Preferably, in the real-time classification module, the special operation monitoring data is classified into high real-time data, medium real-time data and low real-time data according to the evaluation result, specifically: The acquired special operation monitoring data is synchronized to the central system real-time value and compared with the gradient standard threshold, the gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold, and the special operation monitoring data is synchronized to the central system real-time value and compared with the first standard threshold and the second standard threshold respectively; If the real-time value of the special operation monitoring data being synchronized to the central system is greater than the second standard threshold, it indicates that the real-time value of the special operation monitoring data being synchronized to the central system is high, and a high real-time signal is generated at this time, and the special operation monitoring data is classified as high real-time data; If the real-time value of the special operation monitoring data synchronized to the central system is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, it means that the real-time value of the special operation monitoring data synchronized to the central system is average, and a medium real-time signal is generated at this time, and the special operation monitoring data is classified as medium real-time data; If the real-time value of the special operation monitoring data synchronized to the central system is less than the first standard threshold, it means that the real-time value of the special operation monitoring data synchronized to the central system is low. At this time, a low real-time signal is generated and the special operation monitoring data is classified as low real-time data.

[0010] Preferably, in the early warning module, for the real-time data, the degree of abnormality of the real-time synchronization of the special operation monitoring data to the central system within a fixed time period is evaluated, specifically: For medium real-time data, that is, the special operation monitoring data generated within a fixed time period is synchronized to the central system with a real-time value greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the special operation monitoring data generated in a subsequent fixed time period is synchronized to the central system with a real-time value greater than or equal to the first standard threshold and less than or equal to the second standard threshold for collection, and a corresponding data set is established, and the mean and standard deviation of the data set are calculated. After analysis, the degree of abnormality in the real-time synchronization of the special operation monitoring data to the central system within the fixed time period is evaluated.

[0011] Preferably, if the mean of the real-time values ​​in the data set is greater than or equal to the reference threshold of the mean of the real-time values, and the standard deviation of the real-time values ​​is less than the reference threshold of the standard deviation of the real-time values, it means that although the overall real-time performance of the data synchronization is good, the fluctuation is large and the abnormality is high. At this time, a first-level warning signal is generated, the emergency processing process is started, and the operation and maintenance personnel are dispatched to conduct investigations as a priority; If the mean of the real-time values ​​is greater than or equal to the reference threshold of the mean of the real-time values, and the standard deviation of the real-time values ​​is greater than or equal to the reference threshold of the standard deviation of the real-time values, it means that the overall real-time performance of data synchronization is good, with small fluctuations and low abnormality. In this case, no warning signal is generated and routine inspections are performed on related systems. If the mean of the real-time values ​​is less than the reference threshold of the mean of the real-time values, and the standard deviation of the real-time values ​​is greater than or equal to the reference threshold of the standard deviation of the real-time values, it means that the overall real-time performance of data synchronization is poor, with large fluctuations and a high degree of abnormality. In this case, a secondary warning signal is generated to identify and repair network bottlenecks or equipment failures. If the mean of the real-time values ​​is less than the reference threshold of the mean of the real-time values, and the standard deviation of the real-time values ​​is less than the reference threshold of the standard deviation of the real-time values, it means that the overall real-time performance of data synchronization is poor, but the fluctuation is stable and the degree of abnormality is low. At this time, no warning signal is generated, and system optimization or scheduling adjustment is performed.

[0012] In the above technical solution, the technical effects and advantages provided by the present invention are: 1. The present invention provides a method for accurately predicting and analyzing the real-time performance of data synchronization to the central system by comprehensively collecting and evaluating the transmission delay and loss characteristics of special operation monitoring data in real time, combined with advanced machine learning algorithms. By dividing the data into high, medium, and low real-time levels and implementing targeted processing, the system can efficiently identify potential illegal operations, promptly discover and repair network or equipment failures, thereby improving the stability and accuracy of the system. For medium real-time data, by evaluating the degree of abnormality and generating early warning signals, sufficient early warning can be provided before potential problems occur, optimizing operation and maintenance processes and resource scheduling.

[0013] 2. The present invention uses key indicators such as the data transmission delay fluctuation index and the packet loss rate abnormality index, combined with a polynomial regression model for real-time prediction, thereby effectively avoiding system misjudgments caused by data loss, delays and other problems. The real-time evaluation and early warning module can accurately classify early warnings based on the quality of data synchronization, ensure that abnormal operations are identified and processed in a timely manner, and improve the operational efficiency and safety of the highway toll system. Through this system, operation and maintenance personnel can give priority to potential problems in high-real-time and low-real-time data, significantly improve the accuracy and processing efficiency of monitoring data, and ultimately optimize the operation and management of the entire toll system. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0015] Figure 1 It is a system module diagram of the present invention. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] For examples, see Figure 1 As shown, the highway toll anomaly monitoring and identification system described in this embodiment includes a data acquisition module, a feature extraction module, a real-time evaluation module, a real-time division module, an identification processing module and an early warning module; Data collection module: Generates a corresponding timestamp for each special operation record in the site system, and generates a corresponding timestamp for each received special operation data in the central system, and collects a variety of special operation monitoring data from different sites within several time periods; Feature extraction module: pre-processes the collected special operation monitoring data, and extracts features from the pre-processed special operation monitoring data, respectively extracting transmission delay features and data loss features of the special operation monitoring data; Real-time evaluation module: Based on the transmission delay characteristics and data loss characteristics of the extracted special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of the special operation monitoring data to the central system, and the real-time synchronization of the special operation monitoring data to the central system is determined based on the output results of the machine learning model; Real-time classification module: According to the evaluation results, the special operation monitoring data is divided into high real-time data, medium real-time data and low real-time data, and processed accordingly; Identification and processing module: Prioritize real-time analysis of high-real-time data to quickly identify and handle potential illegal operations; prioritize checking sites, equipment, and operations involved in low-real-time data to remind the operation and maintenance team to perform maintenance; Early warning module: For real-time data, the special operation monitoring data within a fixed time period is synchronized to the central system to evaluate the degree of real-time anomaly. If the degree of anomaly is high, an abnormal alarm is issued to relevant operation and maintenance personnel through the early warning system.

[0018] In the data collection module, in the highway toll collection system, special operations usually refer to abnormalities that occur during the toll collection process or operations that require manual intervention, such as manually lifting the bar to release the vehicle, canceling the coil operation, re-printing the invoice, modifying the toll data (such as amount adjustment, vehicle model modification, etc.); the occurrence of these operations needs to be recorded and monitored by the system to ensure the accuracy of the charges and prevent cheating.

[0019] Whenever a particular operation occurs, the site system needs to generate a timestamp for the operation at the moment the event occurred. The timestamp usually consists of two parts: Local timestamp: A time stamp generated by the internal clock of a site device (such as a toll booth or toll collector's console) to mark the exact time when the operation occurred.

[0020] Global standard time: To ensure data synchronization between multiple sites, timestamps also need to use a standard time source (usually Coordinated Universal Time (UTC) or time synchronized based on NTP (Network Time Protocol)). This ensures that data from different sites can be sorted and compared according to a unified standard.

[0021] The operations to generate timestamps usually include: When the toll collection system recognizes a special operation, it immediately records the time when the event occurs. The timestamp is usually the current date and time of the system (including second or millisecond accuracy). Ensure that the local system clock is synchronized with the global standard clock to avoid time errors caused by clock drift. After the site system records the timestamp, it will also upload the record to the central system together with other necessary operation information (such as toll amount, vehicle information, toll collector ID, etc.).

[0022] When the site system uploads special operation monitoring data, the central system will receive and process this data. Each uploaded data will include the local timestamp generated by the site system and the global standard time. The central system will generate a receiving timestamp for each special operation data received, indicating the time when the data was received by the central system. This timestamp is usually generated based on the clock of the central system, but it needs to be synchronized with the clock of the site system. The receiving timestamp is mainly used to ensure that the central system can correctly sort and synchronize the special operation data of different sites according to the time of event occurrence and the time of data reception. By comparing the site timestamp and the central system timestamp, the transmission delay of the data is calculated.

[0023] The central system will verify whether the received timestamp is consistent with the system's own timestamp. If there is a significant deviation, it may indicate a problem in the data transmission process (such as high network latency, equipment failure, etc.). To ensure the clock synchronization between the site system and the central system, the central system may periodically obtain time information from a unified time source (such as an NTP server) to ensure the consistency of the timestamps of all data globally.

[0024] In the highway toll collection system, there are usually multiple toll stations distributed in different geographical locations. The special operation monitoring data of these stations needs to be collected and processed in real time by the central system. The special operation data of each station includes: specific operation records occurring at each station, timestamps of each operation, and other related data, such as toll amount, vehicle information, toll collector ID, etc. The collection process of these data is as follows: Each station will upload special operation data in real time or batches at set time intervals (such as every second, every minute, etc.). The station system uploads the collected special operation data to the central system. Encrypted transmission (such as HTTPS or VPN) is usually used to ensure data security.

[0025] Since multiple sites work at the same time, their data needs to be uploaded and synchronized to the central system. In order to avoid data confusion caused by time asynchrony, the following measures are usually taken: Before the central system receives data, the site system usually uses a standardized protocol (such as NTP or PPS) to synchronize the site's clock. This ensures that the timestamps between different sites are unified. At the receiving end, the central system sorts the special operation data from different sites to ensure that they are processed in the order in which the events occur.

[0026] The collected special operation data includes a large amount of business data in addition to the timestamp. The central system will further analyze and process this data, including removing redundant or invalid data to ensure data quality. According to the timestamp, the transmission delay of the data from the site system to the central system is evaluated. Based on the differences in timestamps, transmission delays and other characteristics, the monitoring system can identify potential abnormal operations or data transmission problems and issue early warnings.

[0027] In this application, in the highway toll collection system, the site system generates a timestamp to accurately record the time when each special operation occurs, while the central system generates a receiving timestamp to mark the time when the data is received. These timestamps not only help ensure the accuracy and consistency of the data, but also provide key support for subsequent data synchronization, delay analysis, and anomaly detection. By collecting and synchronizing data from different sites in real time, it is possible to ensure timely monitoring and effective management of special operations in the toll collection process.

[0028] In the feature extraction module, for the special operation monitoring data in the highway toll system, preprocessing includes: removing outliers, erroneous data or invalid data, such as incomplete records, erroneous format data, etc. Check the missing fields in the data (such as timestamps, toll amounts, etc.), and handle missing data by interpolation, filling or deletion. For some important fields, such as timestamps and operation types, missing values ​​can be handled by estimation or supplementation. Ensure that the timestamp format is unified (such as ISO 8601 format) and perform time zone conversion so that data from different sites can be uniformly analyzed. Convert the data to the appropriate type (for example, convert string type time to date type, or convert amount data to floating numeric type). Normalize some features (such as scaling features such as delay time and data size to a unified range). This helps to reduce the scale differences of each feature in the model. Standardize the data (such as subtracting the mean and dividing by the standard deviation) to ensure that the variance of the data is consistent during the feature extraction stage to avoid biasing the model due to excessive or small data scale.

[0029] The transmission delay feature represents the time difference between the special operation monitoring data sent from the site system to the central system. It reflects the speed from the generation to the processing of data, which can help identify problems such as network delays or equipment failures. Transmission delay is usually measured by the difference between the timestamp generated by the site system and the timestamp when the data is received by the central system. For each record, the calculation formula is: Transmission delay = central system timestamp - site timestamp; this can get the delay time of each special operation record, usually in milliseconds (ms). In order to deeply analyze the system performance, the distribution characteristics of the delay can be extracted, such as: Maximum delay: the slowest delay in historical data. Minimum delay: the fastest data transmission time. Average delay: the average delay over a period of time. Delay fluctuation: the standard deviation of the delay value, reflecting the stability of system transmission. Delay percentile: For example, 95% delay means that the transmission delay of 95% of the data is less than a certain value, providing a more granular understanding of delay performance.

[0030] Data loss characteristics indicate the ratio of data that fails to reach the central system or the amount of data lost during data transmission. Data loss may be caused by network failure, device abnormality, or system crash, and can reflect the reliability and stability of the system.

[0031] A basic indicator of data loss is the packet loss rate. Each site system records the number of packets sent and the number of packets actually received. The number of lost packets can be calculated by the difference between the two. For special operations that lose data, the number of lost records can be directly calculated. These records need to be retransmitted or repaired in a timely manner. Associate packet loss with time periods to analyze whether the packet loss rate is high during certain specific time periods (such as peak hours or when the device load is high). This trend analysis helps to identify potential system bottlenecks or network problems. Monitor the system for data retransmission events. After data is lost, the site system resends the lost data. Record the frequency and number of failures of each retransmission to evaluate the instability of the network or system. By analyzing the type of lost data, distinguish which special operation records are more likely to be lost (for example, certain types of operations may be more likely to be lost due to large data packets or complex operations).

[0032] After analyzing the transmission delay characteristics of the special operation monitoring data sent from the site system to the central system, a data transmission delay fluctuation index is generated. The method for obtaining the data transmission delay fluctuation index is as follows: Delaying the time series Convert to a vector sequence and reconstruct the phase space by delayed embedding: ; Where: Y(t) is a vector representing the state of the system, m is the embedding dimension, which is usually selected by a time delay method (such as the false nearest neighbor method), and τ is the delay time, which is usually selected as the time interval of the data sequence or selected by calculating the autocorrelation function.

[0033] The phase space trajectory Y(t) reconstructed by time series embedding is analyzed to analyze the distance between adjacent vectors, and the Euclidean distance between adjacent vectors Y(t) and Y(t+1) is calculated. , the expression is: ;in, It is the i-th component in the phase space. Starting from the initial time t=0, a pair of very close trajectories is selected, and their distance is calculated. The distance of the pair of trajectories is tracked through time advancement, and the growth of the distance over time is calculated, that is, the data transmission delay fluctuation index is calculated. The calculation formula is: ; Where d(t) is the distance at time t, d(0) is the distance at the initial time, t is time, usually calculated until convergence, and AD is the data transmission delay fluctuation index.

[0034] The larger the data transmission delay fluctuation index is, the greater the volatility of the delay is, the poorer the stability of the system is, and the higher the uncertainty of the transmission delay is. This situation may mean that the network is congested, the equipment fails, or other abnormal conditions occur, resulting in an unstable data transmission process, which affects the real-time nature of the special operation monitoring data. In this case, the system cannot synchronize the special operation monitoring data to the central system in a timely manner, which may delay or lose key abnormal operation data, resulting in the failure to identify and handle illegal operations in a timely manner.

[0035] On the contrary, the smaller the data transmission delay fluctuation index is, the smaller the delay fluctuation is, the more stable the system transmission process is, and the higher the real-time performance is. This shows that the special operation monitoring data can be quickly and stably synchronized to the central system, and the system can detect abnormal operations in time and respond to them, ensuring the accuracy and fairness of the charging process. The low fluctuation index reflects the efficiency and reliability of the system, making real-time data processing more timely and accurate, and reducing the risk of data loss and delay.

[0036] After analyzing the data loss characteristics that fail to reach the central system during special data transmission, a packet loss rate anomaly index is generated. The packet loss rate anomaly index is obtained as follows: Preprocess the acquired packet loss rate time series data to remove noise and outliers in the data (such as through median filtering, smoothing, etc.). Standardize the packet loss rate data so that the data has a uniform scale for subsequent analysis and selection of appropriate wavelet basis functions, such as Daubechies wavelet or Morlet wavelet. The basic formula of wavelet transform is: ;in, is the result of wavelet transform, which represents the transform coefficient of signal f(s) at scale a and position b. It is a wavelet basis function that decomposes the time series data of packet loss rate into multiple different frequency bands (low-frequency part and high-frequency part), reflecting the changes of data at different time scales. According to the wavelet transform results, the coefficients of each frequency component are obtained, which usually include low-frequency and high-frequency components. Low-frequency component: corresponds to the stable part of the data, representing the long-term trend. High-frequency component: corresponds to the fluctuating part of the data, representing short-term fluctuations or emergencies. Mainly focus on high-frequency components, because abnormal packet loss usually manifests as short-term fluctuations or emergencies.

[0037] The high-frequency component extracted from the wavelet transform is assumed to be H(s), where s is the timestamp and H(s) represents the high-frequency fluctuation of the packet loss rate at time t. The standard deviation of the high-frequency component is calculated as follows: ;in: is the standard deviation of the high frequency components, is the mean of the high frequency component, and n is the time length of the data. Calculate volatility (Reflecting short-term fluctuations): ; By combining the standard deviation and volatility characteristics, the packet loss rate anomaly index is calculated: ;in, is the packet loss rate anomaly index.

[0038] The larger the packet loss rate anomaly index is, the higher the fluctuation and anomaly of the packet loss rate in a certain period of time is, indicating that more packet loss has occurred during the data transmission process. The increase in the packet loss rate anomaly index usually means that the real-time performance of data synchronization is greatly affected, especially during peak hours or when the network is congested, the frequency of packet loss increases, resulting in the inability to synchronize special operation monitoring data to the central system in a timely and complete manner. At this time, the system may not be able to identify or handle illegal operations in a timely manner, which in turn affects the operating efficiency and accuracy of the entire charging system.

[0039] The smaller the packet loss rate abnormality index is, the less packet loss there is, the better the stability during data transmission is, and the lower the volatility of the packet loss rate is. At this time, the special operation monitoring data can be quickly and stably synchronized to the central system with high real-time performance. The system can efficiently and accurately identify and process abnormal operations, ensuring that data monitoring during the charging process is not affected by delays or losses, thereby ensuring the safety and fairness of the charging system.

[0040] Real-time evaluation module: Based on the transmission delay characteristics and data loss characteristics of the extracted special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of the special operation monitoring data to the central system, and the real-time synchronization of the special operation monitoring data to the central system is determined based on the output results of the machine learning model; The data transmission delay fluctuation index and the packet loss rate anomaly index are converted into comprehensive feature vectors, and the comprehensive feature vectors are used as the input of the machine learning model. The machine learning model uses each group of comprehensive feature vectors to predict the real-time value label of the special operation monitoring data synchronized to the central system as the prediction target, and takes minimizing the sum of prediction errors of all special operation monitoring data synchronized to the central system as the training target. The machine learning model is trained until the sum of prediction errors converges and the model training is stopped. The real-time value of the special operation monitoring data synchronized to the central system is determined according to the model output results, wherein the machine learning model is a polynomial regression model.

[0041] The method for obtaining the real-time value of special operation monitoring data synchronized to the central system is as follows: obtain the corresponding function expression from the comprehensive feature vector training data of the trained machine learning model: ; In the formula, is the output function of the model, AD is the data transmission delay fluctuation index, is the packet loss rate anomaly index, Synchronize the real-time value of special operation monitoring data to the central system.

[0042] Real-time classification module: According to the evaluation results, the special operation monitoring data is divided into high real-time data, medium real-time data and low real-time data, and processed accordingly; The acquired special operation monitoring data is synchronized to the central system real-time value and compared with the gradient standard threshold, the gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold, and the special operation monitoring data is synchronized to the central system real-time value and compared with the first standard threshold and the second standard threshold respectively; If the real-time value of the special operation monitoring data being synchronized to the central system is greater than the second standard threshold, it indicates that the real-time value of the special operation monitoring data being synchronized to the central system is high, and a high real-time signal is generated at this time, and the special operation monitoring data is classified as high real-time data; If the real-time value of the special operation monitoring data synchronized to the central system is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, it means that the real-time value of the special operation monitoring data synchronized to the central system is average, and a medium real-time signal is generated at this time, and the special operation monitoring data is classified as medium real-time data; If the real-time value of the special operation monitoring data synchronized to the central system is less than the first standard threshold, it means that the real-time value of the special operation monitoring data synchronized to the central system is low. At this time, a low real-time signal is generated and the special operation monitoring data is classified as low real-time data.

[0043] Identification and processing module: Prioritize real-time analysis of high-real-time data to quickly identify and handle potential illegal operations; prioritize sites, equipment, and operations involved in low-real-time data to remind the operation and maintenance team to perform maintenance.

[0044] Highly real-time data will immediately enter the data analysis system to monitor and analyze the validity of this data in real time. For example, the system will immediately detect special operations: manual lifting of the bar, cancellation of the coil operation, re-printing of invoices, and modification of charging data. Through rapid analysis, the system can quickly discover abnormal operations that are inconsistent with the normal charging process. For example, if frequent manual lifting of the bar or abnormal modification of charging data are monitored, the system can immediately mark these operations as suspicious. If the analysis finds potential violations in the data, the system will trigger an automatic alarm and notify the relevant staff or operation and maintenance team for manual verification. Alerts can be sent instantly via SMS, email, system push, etc. to ensure that staff can respond quickly.

[0045] Once the high-real-time data triggers an alarm for illegal operations, the relevant operations will be suspended or terminated. Operators or supervisors can take immediate intervention measures based on the data analysis results, such as prohibiting specific operations (such as manual lifting of the bar), enforcing manual review procedures, and shutting down abnormal equipment or sites, which can effectively prevent the expansion of illegal operations or a significant impact on charging results.

[0046] Abnormal operations of high-real-time data can also serve as a basis for subsequent audits and investigations. If illegal operations are indeed confirmed, further investigations can help identify responsibilities, take necessary penalties, and strengthen the system's preventive measures against similar illegal operations.

[0047] The system will prioritize sites and devices that generate low real-time data, including: analyzing the network for bandwidth bottlenecks, network congestion, and other issues, especially during high-traffic periods. Check the data transmission path between the site and the central system to confirm whether there are delays, packet loss, or jitter. Check the equipment that generates low real-time data to confirm whether there are hardware failures (such as sensors, toll machines, gate equipment, etc.) or software anomalies (such as system freezes, system crashes, etc.). Check the system configuration of the site to confirm whether there are data synchronization issues caused by improper configuration (such as system time synchronization, device parameter configuration errors, etc.).

[0048] The system will automatically generate maintenance reminders and notify the maintenance team via SMS, email or instant messaging tools. The maintenance team needs to conduct a detailed investigation of the site where the low real-time data is located and take appropriate maintenance measures. Common maintenance measures include: If it is found that network problems cause data transmission delays, the bandwidth configuration can be adjusted, the transmission path can be optimized, or network resources can be temporarily increased to relieve the network burden. If the equipment failure causes the data to be not uploaded in time, the faulty equipment should be repaired or replaced immediately to ensure the normal operation of the equipment. If the software or system fails and causes data synchronization delays, the software should be updated or the system restarted in time to restore the normal operation of the system. For low real-time data, there may be some data loss or non-synchronization problems. In order to ensure the integrity of the data, the data supplement and retransmission mechanism can be started. The system can re-request the lost data packets or use cached data to supplement them to restore the normal data flow of the system as much as possible. The processing of low real-time data is not limited to troubleshooting, but requires continuous monitoring of the equipment and network status of the site, evaluating the stability of the system, and preventing similar problems from happening again. The following measures can be used to strengthen monitoring: Early warning module: For real-time data, the special operation monitoring data within a fixed time period is synchronized to the central system to evaluate the degree of real-time anomaly. If the degree of anomaly is high, an abnormal alarm is issued to relevant operation and maintenance personnel through the early warning system.

[0049] For medium real-time data, that is, the special operation monitoring data generated within a fixed time period is synchronized to the central system with a real-time value greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the special operation monitoring data generated in a subsequent fixed time period is synchronized to the central system with a real-time value greater than or equal to the first standard threshold and less than or equal to the second standard threshold for collection, and a corresponding data set is established, and the mean and standard deviation of the data set are calculated. After analysis, the degree of abnormality in the real-time synchronization of the special operation monitoring data to the central system within the fixed time period is evaluated.

[0050] If the mean real-time value in the data set is greater than or equal to the reference threshold of the mean real-time value, and the standard deviation of the real-time value is less than the reference threshold of the standard deviation of the real-time value, it means that the mean real-time value is high, but at the same time the standard deviation is large, indicating that although the overall real-time performance of data synchronization is good, the fluctuation is large and the degree of abnormality is high. There may be potential risks that need to be dealt with immediately. At this time, a first-level warning signal is generated, the emergency processing process is started, possible system problems are quickly located, and operation and maintenance personnel are dispatched to conduct investigations as a priority.

[0051] If the mean of the real-time values ​​is greater than or equal to the reference threshold of the mean of the real-time values, and the standard deviation of the real-time values ​​is greater than or equal to the reference threshold of the standard deviation of the real-time values, it means that the mean of the real-time values ​​is high and the standard deviation is small, indicating that the overall real-time performance of data synchronization is good, with small fluctuations and low abnormality. However, certain checks are still required to ensure system stability. At this time, no early warning signal is generated, and routine checks are performed on related systems to ensure that there are no potential risks. If there are equipment aging or system load problems, timely optimization and adjustments are made.

[0052] If the mean real-time value is less than the reference threshold of the mean real-time value, and the standard deviation of the real-time value is greater than or equal to the reference threshold of the standard deviation of the real-time value, it means that the mean real-time value is low and the standard deviation is large, indicating that the overall real-time performance of data synchronization is poor, with large fluctuations and a high degree of abnormality, indicating that there may be problems such as network delays, equipment failures or configuration errors. At this time, a secondary warning signal is generated to conduct a detailed investigation of the factors affecting the system stability, identify and repair network bottlenecks or equipment failures.

[0053] If the mean real-time value is less than the reference threshold of the mean real-time value, and the standard deviation of the real-time value is less than the reference threshold of the standard deviation of the real-time value, it means that the mean real-time value is low and the standard deviation is small, indicating that the overall real-time performance of data synchronization is poor, but the fluctuation is stable and the degree of abnormality is low. There may be insignificant system load or configuration problems. In this case, no warning signal is generated, system optimization or scheduling adjustment is performed, and the stability of data synchronization is monitored regularly to ensure that system performance is improved.

[0054] It should be noted here that the importance of the first-level warning signal is greater than that of the second-level warning signal, and relevant personnel can take corresponding treatment measures according to different warning signal levels.

[0055] In this embodiment, a comprehensive monitoring and early warning system is formed through multiple functional modules such as data collection, feature extraction, real-time evaluation, real-time division, identification processing and early warning modules. The system generates timestamps in the site system and the central system respectively, and collects special operation monitoring data of different sites and time periods; after preprocessing the data and extracting transmission delay and packet loss features, the machine learning model is used to evaluate the real-time synchronization of the data. The evaluation results are used to divide the data into high, medium and low real-time data, and take corresponding processing measures. High real-time data is prioritized for analyzing potential violations, while low real-time data is prioritized for troubleshooting equipment and network problems. For medium real-time data, the system evaluates according to the degree of abnormality of synchronization real-time, and issues an alarm through the early warning module when the abnormality is serious, reminding the operation and maintenance personnel to deal with potential risks in a timely manner, thereby ensuring the stability and security of the highway toll system.

[0056] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0057] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0058] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. Highway toll anomaly monitoring and identification system, characterized by: It includes data acquisition module, feature extraction module, real-time evaluation module, real-time division module, recognition processing module and early warning module; Data collection module: Generates a corresponding timestamp for each special operation record in the site system, and generates a corresponding timestamp for each received special operation data in the central system, and collects a variety of special operation monitoring data from different sites within several time periods; Feature extraction module: pre-processes the collected special operation monitoring data, and extracts features from the pre-processed special operation monitoring data, respectively extracting transmission delay features and data loss features of the special operation monitoring data; Real-time evaluation module: Based on the transmission delay characteristics and data loss characteristics of the extracted special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of the special operation monitoring data to the central system, and the real-time synchronization of the special operation monitoring data to the central system is determined based on the output results of the machine learning model; Real-time classification module: According to the evaluation results, the special operation monitoring data is divided into high real-time data, medium real-time data and low real-time data, and processed accordingly; Identification and processing module: Prioritize real-time analysis of high-real-time data to quickly identify and handle potential illegal operations; prioritize checking sites, equipment, and operations involved in low-real-time data to remind the operation and maintenance team to perform maintenance; Early warning module: For real-time data, the special operation monitoring data within a fixed time period is synchronized to the central system to evaluate the degree of real-time anomaly. If the degree of anomaly is high, an abnormal alarm is issued to relevant operation and maintenance personnel through the early warning system.

2. The highway toll anomaly monitoring and identification system according to claim 1 is characterized by: In the feature extraction module, the transmission delay feature of the special operation monitoring data sent from the site system to the central system is analyzed to generate a data transmission delay fluctuation index. The method for obtaining the data transmission delay fluctuation index is as follows: Delaying the time series Convert to a vector sequence and reconstruct the phase space by delayed embedding: ; Where: Y(t) is a vector representing the state of the system, m is the embedding dimension, which is usually selected by the time delay method, and τ is the delay time, which is selected as the time interval of the data sequence; The phase space trajectory Y(t) reconstructed by time series embedding is analyzed to analyze the distance between adjacent vectors, and the Euclidean distance between adjacent vectors Y(t) and Y(t+1) is calculated. , the expression is: ;in, It is the i-th component in the phase space. Starting from the initial time t=0, a pair of trajectories is selected, their distance is calculated, the distance of the pair of trajectories is tracked through time advancement, and the growth of the distance over time is calculated, that is, the data transmission delay fluctuation index is calculated. The calculation formula is: ; Where d(t) is the distance at time t, d(0) is the distance at the initial time, t is time, and AD is the data transmission delay fluctuation index.

3. The highway toll anomaly monitoring and identification system according to claim 2 is characterized by: In the feature extraction module, the data loss characteristics that fail to reach the central system during the special data transmission process are analyzed to generate a packet loss rate anomaly index. The packet loss rate anomaly index is obtained as follows: Preprocess the acquired packet loss rate time series data, select the wavelet basis function, and the basic formula of wavelet transform is: ;in, is the result of wavelet transform, which represents the transform coefficient of signal f(s) at scale a and position b. is a wavelet basis function, which decomposes the time series data of the packet loss rate into multiple frequency bands. According to the wavelet transform results, the coefficients of each frequency component are obtained. The high-frequency component extracted from the wavelet transform is set as H(s), where s is the timestamp, and H(s) represents the high-frequency fluctuation part of the packet loss rate at time s. The standard deviation of the high-frequency component is calculated, and the expression is: ;in: is the standard deviation of the high frequency components, is the mean of the high-frequency component, n is the time length of the data, and the volatility is calculated : ; By combining the standard deviation and volatility characteristics, the packet loss rate anomaly index is calculated: ;in, is the packet loss rate anomaly index.

4. The highway toll anomaly monitoring and identification system according to claim 3 is characterized by: In the real-time evaluation module, based on the extracted transmission delay characteristics and data loss characteristics of the special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of the special operation monitoring data to the central system, and the real-time synchronization of the special operation monitoring data to the central system is determined based on the output results of the machine learning model. Specifically: The data transmission delay fluctuation index and the packet loss rate anomaly index are converted into comprehensive feature vectors, and the comprehensive feature vectors are used as the input of the machine learning model. The machine learning model uses each group of comprehensive feature vectors to predict the real-time value label of the special operation monitoring data synchronized to the central system as the prediction target, and takes minimizing the sum of prediction errors of all special operation monitoring data synchronized to the central system as the training target. The machine learning model is trained until the sum of prediction errors converges and the model training is stopped. The real-time value of the special operation monitoring data synchronized to the central system is determined according to the model output results, wherein the machine learning model is a polynomial regression model.

5. The highway toll anomaly monitoring and identification system according to claim 4 is characterized by: In the real-time classification module, according to the evaluation results, the special operation monitoring data is divided into high real-time data, medium real-time data and low real-time data, specifically; The acquired special operation monitoring data is synchronized to the central system real-time value and compared with the gradient standard threshold, the gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold, and the special operation monitoring data is synchronized to the central system real-time value and compared with the first standard threshold and the second standard threshold respectively; If the real-time value of the special operation monitoring data being synchronized to the central system is greater than the second standard threshold, it indicates that the real-time value of the special operation monitoring data being synchronized to the central system is high, and a high real-time signal is generated at this time, and the special operation monitoring data is classified as high real-time data; If the real-time value of the special operation monitoring data synchronized to the central system is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, it means that the real-time value of the special operation monitoring data synchronized to the central system is average, and a medium real-time signal is generated at this time, and the special operation monitoring data is classified as medium real-time data; If the real-time value of the special operation monitoring data synchronized to the central system is less than the first standard threshold, it means that the real-time value of the special operation monitoring data synchronized to the central system is low. At this time, a low real-time signal is generated and the special operation monitoring data is classified as low real-time data.

6. The highway toll anomaly monitoring and identification system according to claim 1 is characterized by: In the early warning module, for real-time data, the real-time abnormality of the special operation monitoring data synchronized to the central system within a fixed time period is evaluated, specifically: For medium real-time data, that is, the special operation monitoring data generated within a fixed time period is synchronized to the central system with a real-time value greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the special operation monitoring data generated in a subsequent fixed time period is synchronized to the central system with a real-time value greater than or equal to the first standard threshold and less than or equal to the second standard threshold for collection, and a corresponding data set is established, and the mean and standard deviation of the data set are calculated. After analysis, the degree of abnormality in the real-time synchronization of the special operation monitoring data to the central system within the fixed time period is evaluated.

7. The highway toll anomaly monitoring and identification system according to claim 6 is characterized by: If the mean of the real-time values ​​in the data set is greater than or equal to the reference threshold of the mean of the real-time values, and the standard deviation of the real-time values ​​is less than the reference threshold of the standard deviation of the real-time values, it means that although the overall real-time performance of data synchronization is good, the fluctuation is large and the degree of abnormality is high. At this time, a first-level warning signal is generated, the emergency processing process is started, and the operation and maintenance personnel are dispatched to conduct investigations as a priority; If the mean of the real-time values ​​is greater than or equal to the reference threshold of the mean of the real-time values, and the standard deviation of the real-time values ​​is greater than or equal to the reference threshold of the standard deviation of the real-time values, it means that the overall real-time performance of data synchronization is good, with small fluctuations and low abnormality. In this case, no warning signal is generated and routine inspections are performed on related systems. If the mean of the real-time values ​​is less than the reference threshold of the mean of the real-time values, and the standard deviation of the real-time values ​​is greater than or equal to the reference threshold of the standard deviation of the real-time values, it means that the overall real-time performance of data synchronization is poor, with large fluctuations and a high degree of abnormality. In this case, a secondary warning signal is generated to identify and repair network bottlenecks or equipment failures. If the mean of the real-time values ​​is less than the reference threshold of the mean of the real-time values, and the standard deviation of the real-time values ​​is less than the reference threshold of the standard deviation of the real-time values, it means that the overall real-time performance of data synchronization is poor, but the fluctuation is stable and the degree of abnormality is low. At this time, no warning signal is generated, and system optimization or scheduling adjustment is performed.

Images